The proliferation of remotely accessed computer and telecommunications systems have increased the need for improved security systems which check for valid passwords, PINS, and access codes/authentication codes (collectively referred to herein as "passwords") before granting access. While breaches of security can take many forms, one of the most common forms of attack by unauthorized users (sometimes called "hackers") is educated guessing and/or trial and error to discover the valid password through repeated, albeit usually unsuccessful, access attempts. With each attempt, the hacker readjusts the password being used; he/she actually gains valuable information from each denial, since most existing security systems permit access "if and only if" the correct password is entered, and deny access if any other password is entered, so that a denial reveals that an attempted password is actually invalid. The trial and error process is most often automated by the hacker, so that convergence to a correct password can sometimes undesirably be very fast.
In order to defeat the hacker or other unauthorized access seeker, legitimate users are instructed not only to keep passwords secret, but also to choose them carefully to avoid guessing. Sometimes it is difficult to insure that authorized users haven't chosen trivial variants of easily guessable words or sequences.
One attempt to improve access security was described by K. Dehnad in an article entitled "A Simple Way of Improving the Login Security", Computers and Security, Vol. 8, No. 7, 1989, pages 607-11. According to the author, the advantage gained by a hacker in repeated access attempts can be reduced by controlling the probability (p) that an authorized user will gain access to the target system even when the proper password is entered. This variability has the effect of reducing the information obtained by the hacker in being denied access: he/she cannot be sure that the denial is due to the fact that an invalid password was used, and thus may have to repeat the attempt, thereby increasing the number of trial and error attempts that may be necessary. This approach necessitates that authorized users be occasionally inconvenienced by having to enter the correct password more than once: if p=0.95, the authorized user will, on average, have to make about 105 attempts to gain access 100 times. Dehnad also suggests that the value of "p" can be reduced, thereby increasing the penalty imposed on a hacker if repeated unsuccessful access attempts are detected. While the author argues that this may be an acceptable price to pay for enhanced security, alternative solutions which have additional flexibility are desired.
To counter the threat of an attacker guessing a password by trial and error, other security systems use a control mechanism sometimes known as "lockout" that relies on counting unsuccessful attempts and completely stopping access to the person seeking access once there have been "too many" unsuccessful access attempts. When the system is "locked", subsequent access attempts, both valid and invalid, will be blocked. There are, unfortunately, problems with this approach, since it essentially trades "Access Control" for "Denial of Service". Specifically, by completely cutting off access after a preset but relatively small number of unsuccessful access attempts, the hacker is frustrated by stringent access control, but the legitimate user who unfortunately erred during attempted access attempts is also undesirably denied service or access. On the other hand, if lockout is not used at all, or is only instituted after a relatively large number of access attempts, the legitimate user may gain access more easily, but the hacker may also more frequently get through to the computer, network or other resource being accessed. To date, there has been no compromise solution.